@samebase/alchemy-convex 0.18.0 → 0.19.1

package/README.md

@@ -7,9 +7,11 @@ URLs to a Cloudflare Worker or a Vite site as ordinary outputs. No deploy key go
 to another. The Convex CLI that your app installs keeps doing typecheck, codegen, bundling, and the
 push.
 
-Alchemy has no built-in Convex provider ([alchemy-run/alchemy-async#1306](https://github.com/alchemy-run/alchemy-async/issues/1306)).
-This is a community provider, maintained by [Samebase](https://samebase.com). The resource model
-follows the "Convex Plain" mode of [rjdellecese/confect#408](https://github.com/rjdellecese/confect/issues/408).
+Alchemy has no built-in Convex provider
+([alchemy-run/alchemy-async#1306](https://github.com/alchemy-run/alchemy-async/issues/1306)). This
+is a community provider, maintained by [Samebase](https://samebase.com). The resource model follows
+the "Convex Plain" mode of
+[rjdellecese/confect#408](https://github.com/rjdellecese/confect/issues/408).
 [docs/design/convex-plane.md](docs/design/convex-plane.md) records the decisions.
 
 Status: pinned to `alchemy@2.0.0-beta.84` and Effect 4. Alchemy ships breaking changes between
@@ -66,16 +68,15 @@ export default Alchemy.Stack(
 The imports are `alchemy`, `@alchemy.run/cloudflare`, `alchemy/RemovalPolicy`, `effect/Config`,
 `effect/Effect`, `effect/Layer`, and `@samebase/alchemy-convex` as `Convex`. Order follows the
 outputs: the project exists before its deployment, and the push finishes before the site build. The
-first `alchemy deploy --stage prod` takes over the existing project, and its production
-deployment if it has code, only with `--adopt`.
-`alchemy destroy --stage pr-42` deletes the preview deployment. Without `RemovalPolicy.destroy()`,
-it stays until Convex deletes it at expiry (14 days by default).
+first `alchemy deploy --stage prod` takes over the existing project, and its production deployment
+if it has code, only with `--adopt`. `alchemy destroy --stage pr-42` deletes the preview deployment.
+Without `RemovalPolicy.destroy()`, it stays until Convex deletes it at expiry (14 days by default).
 [`examples/app/alchemy.run.ts`](examples/app/alchemy.run.ts) is the same stack.
 
 ### The stack file at the repository root
 
-`rootDir` is the app directory, relative to the directory where `alchemy deploy` runs, which is
-the directory of the stack file. The default is `"."`. The push runs in `rootDir`, and `source` is
+`rootDir` is the app directory, relative to the directory where `alchemy deploy` runs, which is the
+directory of the stack file. The default is `"."`. The push runs in `rootDir`, and `source` is
 relative to it:
 
 ```ts
@@ -128,10 +129,9 @@ The deployment's Alchemy state row stores this entry in its native `bindings` ar
 }
 ```
 
-Readers inspect each binding's `data`. The deployment attributes identify the Convex deployment;
-the row's stack and stage identify the Alchemy scope. The live repository reader includes the
-binding through its existing resource JSON. No extra resource list, state table, or subscription
-is needed.
+Readers inspect each binding's `data`. The deployment attributes identify the Convex deployment; the
+row's stack and stage identify the Alchemy scope. The live repository reader includes the binding
+through its existing resource JSON. No extra resource list, state table, or subscription is needed.
 
 Use actual namespace ancestry when grouping resources. A slash in a resource's logical ID is not a
 namespace boundary. For a nested install, join the installed names with slashes, such as
@@ -158,8 +158,8 @@ reads them through the stack's config provider (process env, `.env`, stack secre
     actions), because the provider reads the project and type of its deployment first.
   - A preview deploy key of a project (`preview:<team>:<project>|...`) creates, pushes to, and
     deletes preview deployments of that project. It cannot change variables: with `env`, the
-    provider uses the access token, and without one it stops with `EnvironmentNeedsDeployKey`
-    before it creates anything. Use project default variables in the Convex dashboard for previews.
+    provider uses the access token, and without one it stops with `EnvironmentNeedsDeployKey` before
+    it creates anything. Use project default variables in the Convex dashboard for previews.
 
 A key that does not fit the deployment is not used: the provider uses the access token. To pass
 values explicitly: `Convex.providers(Convex.fromValues({ accessToken, deployKey }))`.
@@ -168,9 +168,9 @@ values explicitly: `Convex.providers(Convex.fromValues({ accessToken, deployKey
 
 `state: Convex.state({ team })` keeps the Alchemy state of every stack and stage of a Convex team in
 one project of that team, `alchemy-state-store`, the same name as the Cloudflare state store of
-Alchemy, so a repository holds one secret and a stack can create
-and destroy its own project. [docs/design/convex-state.md](docs/design/convex-state.md) records the
-decisions and the measurements.
+Alchemy, so a repository holds one secret and a stack can create and destroy its own project.
+[docs/design/convex-state.md](docs/design/convex-state.md) records the decisions and the
+measurements.
 
 ```ts
 export default Alchemy.Stack(
@@ -182,27 +182,52 @@ export default Alchemy.Stack(
 );
 ```
 
-Every run needs the team token in `CONVEX_ACCESS_TOKEN`, or the Convex CLI login on a laptop. A
-team access token names its team, so `Convex.state()` needs no `team` with one; a `team` slug that
-is set must be the slug of that team, checked against its projects, and a token of another team
-fails the run. The Convex CLI login needs the slug or the id. The first run of a team creates
-the project `alchemy-state-store` and pushes the store functions to its
-production deployment with the Convex CLI of the app; a later version of this package pushes a
-newer store when it finds an older one. A store that is newer than the package fails the run with
-both versions, so the repositories of a team upgrade the package together. Each run makes a
-deploy key of that deployment that can only run the store's internal functions, and deletes it at
-the end. Rows are in the tables `resources` and `outputs` of the component `alchemyState` in the
-dashboard, under the stack name.
-The store has no lock: run one deploy of a stage at a time, such as with a CI concurrency group.
-The store and its readers (Samebase) are released and upgraded together.
-
-Store version 3 supports native subscriptions. A trusted server checks repository access, then
-calls internal `reader:authorize({ repository, subject })` with a deployment credential. It gives
-the returned token to a separate `ConvexClient` connected to the state deployment. The client
-subscribes to `reader:repository({})`; the verified token selects the repository. The token has a
-five-minute lifetime and permits redacted reads only. The server checks access again on renewal.
-The store uses its own native signing key and JWKS, so no extra signing secret is required.
-See [the reader contract](docs/design/convex-state.md#repository-subscriptions-090).
+Every run needs the team token in `CONVEX_ACCESS_TOKEN`, or the Convex CLI login on a laptop. A team
+access token names its team, so `Convex.state()` needs no `team` with one; a `team` slug that is set
+must be the slug of that team, checked against its projects, and a token of another team fails the
+run. The Convex CLI login needs the slug or the id. The first run of a team creates the project
+`alchemy-state-store` and pushes the store functions to its production deployment with the Convex
+CLI of the app; a later version of this package pushes a newer store when it finds an older one. A
+store that is newer than the package fails the run with both versions, so the repositories of a team
+upgrade the package together. Each run makes a deploy key of that deployment that can only run the
+store's internal functions, and deletes it at the end. Rows are in the tables `resources` and
+`outputs` of the component `alchemyState` in the dashboard, under the stack name. The store has no
+lock: run one deploy of a stage at a time, such as with a CI concurrency group. The store and its
+readers (Samebase) are released and upgraded together.
+
+Store version 3 supports native subscriptions. A trusted server checks repository access, then calls
+internal `reader:authorize({ repository, subject })` with a deployment credential. It gives the
+returned token to a separate `ConvexClient` connected to the state deployment. The client subscribes
+to `reader:repository({})`; the verified token selects the repository. The token has a five-minute
+lifetime and permits redacted reads only. The server checks access again on renewal. The store uses
+its own native signing key and JWKS, so no extra signing secret is required. See
+[the reader contract](docs/design/convex-state.md#repository-subscriptions-090).
+
+### Secrets in the rows
+
+Alchemy writes a `Redacted` value in clear text, and a row must keep it: the hub keeps only the hash
+of a client secret, so the next run can get the value only from the state. The store seals each of
+these values with AES-256-GCM before it writes the row. A table view, a snapshot, and a reader that
+forgets to remove secrets show no value.
+
+Each key is one variable `STATE_KEY_<keyId>` of the store deployment, and a sealed value names its
+key. A run that finds no key makes one, writes it to the deployment, and never reads it back. A
+transaction in the store chooses the current key, so two first runs cannot replace a key that a row
+needs. Each run asks if every row is sealed under the current key, and finishes the work of a run
+that stopped.
+
+The functions that a run reads with open the values, so a holder of the team token or of a key that
+can run internal queries still reads every secret of the team. A value that is not `Redacted`, such
+as a plain string in `env`, stays clear text.
+
+To rotate the key, from a directory that selects the project `alchemy-state-store`:
+
+1. Add a key with a new id of letters and digits:
+   `npx convex env set --prod STATE_KEY_<keyId> "$(openssl rand -base64 32)"`.
+2. Make it the current key: `npx convex run --prod state:rotateKey '{"keyId":"<keyId>"}'`.
+3. The next run seals every value under it. To do this now: `npx convex run --prod state:reseal`.
+4. When `npx convex run --prod state:sealing` answers `"sealed": true`, remove the old variable. A
+   key that left the deployment before that cannot open its values.
 
 ### What the output records about a run
 
@@ -241,15 +266,15 @@ call.
 
 - `Convex.Project`: `{ team, name, deploymentRegion?, deploymentType? }` creates a project with its
   default deployment, or takes over one with that exact name with `--adopt`. A changed `name`
-  renames the project in place. `{ team, slug }` is an existing project, found by its slug and
-  taken over with `--adopt`; it never creates or renames a project. Outputs `projectId`, `slug`,
-  `name`, `teamId`, `prodDeploymentName`, `prodDeploymentUrl`.
+  renames the project in place. `{ team, slug }` is an existing project, found by its slug and taken
+  over with `--adopt`; it never creates or renames a project. Outputs `projectId`, `slug`, `name`,
+  `teamId`, `prodDeploymentName`, `prodDeploymentUrl`.
 - `Convex.Deployment`: `{ project, type: "prod" }` or `{ project, type: "dev" | "preview", name }`,
   each with optional `rootDir`, `source`, and `env`. Outputs `name` (such as `happy-animal-123`),
   `url`, `siteUrl`, `type`, `projectId`, `reference`, `previewName`, `hash`, and `envNames`.
-  - `prod` is the project's default production deployment (with a deploy key: the key's
-    production deployment). The resource never creates or deletes one. A production deployment
-    with code that is not in state is taken over only with `--adopt`.
+  - `prod` is the project's default production deployment (with a deploy key: the key's production
+    deployment). The resource never creates or deletes one. A production deployment with code that
+    is not in state is taken over only with `--adopt`.
   - `dev` creates a dev deployment with `name` as its reference; `preview` creates a preview
     deployment with `name` as its preview name. An expired preview is created again on the next
     deploy.
@@ -264,24 +289,24 @@ call.
     lockfile, the deployment name, and `env`. The same hash is a no-op. Otherwise the update sets
     `env`, then pushes. A failed push sets the changed variables back, and deletes a dev or preview
     deployment that the same run created.
-  - `env` values are strings or secrets such as `Config.Redacted("AUTH_SECRET")`. A name that
-    leaves `env` is removed from the deployment.
+  - `env` values are strings or secrets such as `Config.Redacted("AUTH_SECRET")`. A name that leaves
+    `env` is removed from the deployment.
   - `source: { path, command?, include? }` replaces `convex deploy` with `command`, run in `rootDir`
     with the push key in `CONVEX_DEPLOY_KEY`, such as
     `["node_modules/.bin/convex-hosting", "deploy", "--build", "node_modules/.bin/vp build", "--dist", "dist/client"]`.
     The command must push with `convex deploy` (convex-hosting does, through `--cmd`). `include`
     narrows the hash to `path`, package.json, convex.json, the lockfile, and the listed globs, such
-    as the build inputs `["src/**", "public/**", "vite.config.ts"]`. A minted key for a command
-    has every action, because the command can do more than a push.
+    as the build inputs `["src/**", "public/**", "vite.config.ts"]`. A minted key for a command has
+    every action, because the command can do more than a push.
 
 - `Convex.HubClient`: `{ team, app, redirectUri, deploymentType, clientName, softwareVersion? }`
   registers one deployment as a client of the identity hub of the team. The hub is the production
-  deployment of the project `identity-hub`. The resource finds it by name and runs
-  its internal function `identityBroker:registerClient` with a short-lived key, so the stack needs no
-  other credential and no hub address. The first client of an `app` creates the app. Outputs
-  `issuer`, `clientId`, `clientSecret`, `redirectUri`, `deploymentType`, and `clientName`, which the
-  `env` of the `Convex.Deployment` writes to the deployment. Another `redirectUri` is a new client, and
-  a destroy deletes the client.
+  deployment of the project `identity-hub`. The resource finds it by name and runs its internal
+  function `identityBroker:registerClient` with a short-lived key, so the stack needs no other
+  credential and no hub address. The first client of an `app` creates the app. Outputs `issuer`,
+  `clientId`, `clientSecret`, `redirectUri`, `deploymentType`, and `clientName`, which the `env` of
+  the `Convex.Deployment` writes to the deployment. Another `redirectUri` is a new client, and a
+  destroy deletes the client.
 
 A development deployment has no stack, so the package has a command for it. Run it in the directory
 of the app, before the first push: it registers the deployment of that directory with
@@ -329,8 +354,8 @@ repository `owner/name`. A stack without the stage of the pull request has no ca
   `DeploymentIdentityChange`. A production deployment is never deleted, also not with
   `RemovalPolicy.destroy()`, and also not a dev deployment that became one.
 - A dev or preview deployment that exists but is not in state belongs to someone else, such as a
-  preview that CI made. The resource takes it over only with `--adopt`, and never creates over it:
-  a Convex create for an existing preview name deletes that preview.
+  preview that CI made. The resource takes it over only with `--adopt`, and never creates over it: a
+  Convex create for an existing preview name deletes that preview.
 - With the access token, each push uses a new deploy key with only `deployment:deploy`,
   `deployment:env:view`, and `deployment:env:write`, which expires after two hours and is deleted
   after the push, also after a failure. With an OAuth token, Convex returns the token itself as the
@@ -347,8 +372,9 @@ repository `owner/name`. A stack without the stage of the pull request has no ca
 
 ## Limits
 
-- `env` values are props, so Alchemy state holds them. Keep `.alchemy/` git-ignored, and use an
-  encrypted state store, such as `Cloudflare.state()`, in CI.
+- `env` values are props, so Alchemy state holds them. `Convex.state()` seals the `Redacted` values
+  (see [Secrets in the rows](#secrets-in-the-rows)). Use `Config.Redacted` for a secret, and keep
+  `.alchemy/` git-ignored.
 - The hash does not see a change in a workspace package outside `rootDir`, or a push from outside
   Alchemy. Change a file of the app to push again.
 - With a deploy key, the provider reaches the deployment at `https://<name>.convex.cloud`, so the
@@ -362,21 +388,22 @@ repository `owner/name`. A stack without the stage of the pull request has no ca
 
 ## Development
 
+This package is in the [Samebase repository](https://github.com/samebase/samebase), in
+`packages/alchemy-convex`. Run these commands from this folder:
+
 ```sh
 pnpm install
-pnpm run check            # format, lint, typecheck, unit tests
-pnpm run build            # lib/ with declarations, then publint and attw
+pnpm run check            # typecheck, lint, unit tests, build
 pnpm run test:live        # real API calls, see below
 ```
 
-Use Node 24 (`.node-version`) and pnpm 11. Unit tests run against recorded Management API payloads
-in `test/fixtures/management/` and a fake Convex CLI. Live tests run only with
-`ALCHEMY_CONVEX_LIVE=1`, which `pnpm run test:live` sets. They need a Convex login or
-`CONVEX_ACCESS_TOKEN` that can create projects in `ALCHEMY_CONVEX_LIVE_TEAM`. Each test creates a
-project whose name starts with `ALCHEMY_CONVEX_LIVE_PREFIX` (default `tmp-alchemy-convex-`),
-deletes it at the end, also after a failure, and refuses to delete a project, or a deployment of a
-project, without that prefix. A file argument runs one live file only, for example
-`pnpm run test:live test/live/plane.live.test.ts`.
+Unit tests run against recorded Management API payloads in `test/fixtures/management/` and a fake
+Convex CLI. Live tests run only with `ALCHEMY_CONVEX_LIVE=1`, which `pnpm run test:live` sets. They
+need a Convex login or `CONVEX_ACCESS_TOKEN` that can create projects in `ALCHEMY_CONVEX_LIVE_TEAM`.
+Each test creates a project whose name starts with `ALCHEMY_CONVEX_LIVE_PREFIX` (default
+`tmp-alchemy-convex-`), deletes it at the end, also after a failure, and refuses to delete a
+project, or a deployment of a project, without that prefix. A file argument runs one live file only,
+for example `pnpm run test:live test/live/plane.live.test.ts`.
 
 Releases: change `version` in `package.json` in a pull request. After the merge,
 `.github/workflows/release.yml` publishes that version from `main` with npm trusted publishing.

package/lib/{HubClient-BZKweNfD.js → HubClient-NUvPkolM.js}

@@ -1,3 +1,4 @@
+import { n as newKeyId, t as newKey } from "./sealedSecret-Bf8AeIp_.js";
 import { createRequire } from "node:module";
 import { Stack } from "alchemy/Stack";
 import * as Effect from "effect/Effect";
@@ -181,7 +182,11 @@ const TokenDetails = Schema.Union([Schema.Struct({
 	projectId: Schema.Number
 })]);
 /** The service for one way to get the bearer token. */
-const makeService = (credentials) => {
+const makeService = (source) => {
+	const credentials = source.pipe(Effect.map((resolved) => ({
+		...resolved,
+		accessToken: Redacted.make(Redacted.value(resolved.accessToken).trim())
+	})));
 	const client = Effect.cached(credentials.pipe(Effect.map((resolved) => createManagementClient(Redacted.value(resolved.accessToken))))).pipe(Effect.flatten);
 	const request = (operation, run) => client.pipe(Effect.flatMap((c) => settle(operation, () => run(c))));
 	const requestVoid = (operation, run) => client.pipe(Effect.flatMap((c) => settleVoid(operation, () => run(c))));
@@ -239,6 +244,7 @@ const makeService = (credentials) => {
 		return match.id;
 	});
 	const isCredentialToken = (secret) => credentials.pipe(Effect.map((resolved) => tokenPart(Redacted.value(resolved.accessToken)) === tokenPart(secret)));
+	const isOAuthCredential = credentials.pipe(Effect.map((resolved) => /^(team|project):/.test(Redacted.value(resolved.accessToken))));
 	const withToken = (token) => makeService(Effect.succeed({
 		accessToken: token,
 		source: "explicit"
@@ -249,6 +255,7 @@ const makeService = (credentials) => {
 		deploymentRequest,
 		resolveTeamId,
 		isCredentialToken,
+		isOAuthCredential,
 		withToken
 	};
 };
@@ -475,13 +482,15 @@ const cliEnvironment = (home) => ({
 /**
 * A deploy key of `deployment` that expires after PUSH_KEY_LIFETIME_MS, with
 * only `allowedActions`, or every action when that is undefined. Delete it
-* with {@link deleteDeployKey} when the work is done.
+* with {@link deleteDeployKey} when the work is done. An OAuth credential sends
+* only the name: Convex refuses both limits and returns the OAuth token.
 */
 const createDeployKey = (api, deployment, name, allowedActions) => Effect.gen(function* () {
 	const now = yield* Clock.currentTimeMillis;
+	const oauth = yield* api.isOAuthCredential;
 	const created = yield* api.request("create deploy key", (client) => client.POST("/deployments/{deployment_name}/create_deploy_key", {
 		params: { path: { deployment_name: deployment } },
-		body: {
+		body: oauth ? { name } : {
 			name,
 			...allowedActions === void 0 ? {} : { allowedActions: [...allowedActions] },
 			expiresAt: now + PUSH_KEY_LIFETIME_MS
@@ -1207,7 +1216,7 @@ const listProjectsByName = (api, teamId, name) => Effect.gen(function* () {
 	const matches = [];
 	const seenCursors = /* @__PURE__ */ new Set();
 	let cursor;
-	while (true) {
+	for (;;) {
 		const body = yield* api.request("list projects", (client) => client.GET("/teams/{team_id}/projects", { params: {
 			path: { team_id: teamId },
 			query: {
@@ -1508,6 +1517,10 @@ const withRunRecord = (output, record) => isPlainObject(output) ? "samebase.run"
 	[RUN_RECORD_KEY]: record
 } : void 0;
 //#endregion
+//#region src/store/convex/sealing.ts
+/** The variable of the store deployment that holds the key `keyId`. */
+const stateKeyName = (keyId) => `STATE_KEY_${keyId}`;
+//#endregion
 //#region src/State.ts
 /** The name of the state project in each team. */
 const STORE_PROJECT_NAME = "alchemy-state-store";
@@ -1517,6 +1530,8 @@ const STORE_PROJECT_NAME = "alchemy-state-store";
 * `deployment:data:write` do not run an internal function.
 */
 const RUN_KEY_ACTIONS = ["deployment:functions:runInternalQueries", "deployment:functions:runInternalMutations"];
+/** The actions of the key of one run on the store: its writes are actions that seal. */
+const STORE_KEY_ACTIONS = [...RUN_KEY_ACTIONS, "deployment:functions:runInternalActions"];
 /** The body of POST /api/function, with HTTP 200 for a function error too. */
 const Reply = Schema.Union([Schema.Struct({
 	status: Schema.Literal("success"),
@@ -1557,6 +1572,13 @@ const post = (url, headers, body) => Effect.tryPromise({
 	times: 5
 }));
 const decode = (schema, what) => (value) => Schema.decodeUnknownEffect(schema)(value).pipe(Effect.mapError(() => failure(`bad ${what}`)));
+/** The reply of `state:sealing`. */
+const Sealing = Schema.Struct({
+	current: Schema.NullOr(Schema.String),
+	sealed: Schema.Boolean
+});
+/** The reply of `state:reseal`. */
+const Resealed = Schema.Struct({ failed: Schema.Array(Schema.String) });
 const makeFunctionApi = (url, key) => ({ call: (path, args) => post(`${url}/api/function`, { Authorization: `Convex ${Redacted.value(key)}` }, {
 	path,
 	args,
@@ -1639,7 +1661,7 @@ const storeDirectory = () => join(dirname(fileURLToPath(import.meta.url)), "..",
 */
 const pushStore = (options, deployment) => Effect.gen(function* () {
 	const cli = yield* installedCli(join(options.store, ".."));
-	yield* Effect.logInfo(`Convex state: pushing the store version 4 to ${deployment.name}`);
+	yield* Effect.logInfo(`Convex state: pushing the store version 5 to ${deployment.name}`);
 	yield* withPushKey(options.api, deployment.name, PUSH_KEY_ACTIONS, (key) => push(options.spawner, key, {
 		deployment: deployment.name,
 		url: deployment.deploymentUrl,
@@ -1662,6 +1684,26 @@ const pushStore = (options, deployment) => Effect.gen(function* () {
 	}));
 });
 /**
+* Finishes the sealing of the store, whatever an earlier run left: a new key when the store has
+* none, then a reseal unless one finished under the current key. A run reads this each time, so a
+* run that stopped after a push cannot leave rows in clear text. This client makes a key once, and
+* it never reads a key back.
+*/
+const ensureSealed = (options, deployment, functions) => Effect.gen(function* () {
+	const { current, sealed } = yield* functions.call("state:sealing", {}).pipe(Effect.flatMap(valueOf), Effect.flatMap(decode(Sealing, "state:sealing")));
+	if (current === null) {
+		const keyId = newKeyId();
+		yield* withPushKey(options.api, deployment.name, PUSH_KEY_ACTIONS, (key) => writeVariables(deployment.deploymentUrl, key, [{
+			name: stateKeyName(keyId),
+			value: newKey()
+		}]));
+		yield* functions.call("state:chooseKey", { keyId }).pipe(Effect.flatMap(valueOf));
+	}
+	if (sealed) return;
+	const { failed } = yield* functions.call("state:reseal", {}).pipe(Effect.flatMap(valueOf), Effect.flatMap(decode(Resealed, "state:reseal")));
+	if (failed.length > 0) yield* Effect.logWarning(`Convex state: the store could not seal ${failed.join(", ")}. The next run tries again.`);
+});
+/**
 * Creates the state project of the team. Two first runs can both create one:
 * the run whose project is not the oldest deletes its own, which holds
 * nothing yet, and uses the oldest, so that every run ends on one store.
@@ -1693,7 +1735,7 @@ const makeConvexState = (options) => Effect.gen(function* () {
 	if (deployment === void 0) return yield* new ProductionDeploymentNotFound({ projectId: project.id });
 	const keys = [];
 	yield* Scope.addFinalizer(options.scope, Effect.suspend(() => Effect.forEach(keys, (key) => deleteDeployKey(api, deployment.name, key), { discard: true })));
-	const mint = createDeployKey(api, deployment.name, STORE_PROJECT_NAME, RUN_KEY_ACTIONS).pipe(Effect.map((key) => {
+	const mint = createDeployKey(api, deployment.name, STORE_PROJECT_NAME, STORE_KEY_ACTIONS).pipe(Effect.map((key) => {
 		keys.push(key);
 		return makeFunctionApi(deployment.deploymentUrl, key);
 	}), Effect.mapError((error) => failure(`no key for ${deployment.name}: ${error.message}`)));
@@ -1703,15 +1745,16 @@ const makeConvexState = (options) => Effect.gen(function* () {
 		return next.call(path, args);
 	})))) };
 	let version = yield* storeVersion(functions);
-	if (version === void 0 || version < 4) {
+	if (version === void 0 || version < 5) {
 		if (version === void 0 && deployment.lastDeployTime) return yield* failure(`project ${STORE_PROJECT_NAME} (${project.id}) of team ${team} has code that is not the state store, and Convex.state does not push over it. Rename that project in the Convex dashboard.`);
 		version = yield* storeVersion(functions);
-		if (version === void 0 || version < 4) {
+		if (version === void 0 || version < 5) {
 			yield* pushStore(options, deployment);
 			version = yield* storeVersion(functions);
 		}
 	}
-	if (version !== 4) return yield* failure(`${deployment.name} answers store version ${version ?? "none"}, and this package needs store version 4.`);
+	if (version !== 5) return yield* failure(`${deployment.name} answers store version ${version ?? "none"}, and this package needs store version 5.`);
+	yield* ensureSealed(options, deployment, functions);
 	const remote = remoteOf(functions, options.run);
 	/** The stack's output plus the record, when the run has one and the output has a place for it. */
 	const documentOf = (request) => Effect.gen(function* () {
@@ -1910,4 +1953,4 @@ const registerDevelopmentClient = (options) => Effect.gen(function* () {
 //#endregion
 export { PushTargetMismatch as A, DEPLOY_KEY_ENV as B, DeploymentProvider as C, ConvexAppNotFound as D, CodePushFailed as E, ManagementApi as F, fromValues as H, ManagementApiLive as I, ACCESS_TOKEN_ENV as L, installedCli as M, parseDeployOutput as N, ConvexCliNotFound as O, ConvexApiError as P, Credentials as R, DeploymentIdentityChange as S, ProductionDeploymentNotFound as T, fromConfig as V, ProjectProvider as _, registerDevelopmentClient as a, AmbiguousDeployment as b, RUN_RECORD_KEY as c, withRunRecord as d, AmbiguousProject as f, ProjectNotFound as g, ProjectDeploymentChange as h, HubClientProvider as i, VariablesOwnedBySomeoneElse as j, EnvironmentNeedsDeployKey as k, RunRecordError as l, Project as m, HubClient as n, STORE_PROJECT_NAME as o, CreatedProjectNotFound as p, HubClientFailed as r, state as s, HUB_PROJECT_NAME as t, runRecord as u, ProjectTeamChange as v, DeploymentResource as w, Deployment as x, AbsoluteRootDir as y, CredentialsError as z };
 
-//# sourceMappingURL=HubClient-BZKweNfD.js.map
+//# sourceMappingURL=HubClient-NUvPkolM.js.map